{"id":"CVE-2026-111400","kind":"vulnerability","aliases":["CVE-2026-111400"],"related":[],"title":"PowerPack Addons for Elementor: stored XSS through version 3.1.0","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.","summary":"PowerPack Addons for Elementor, a WordPress plugin, has a stored cross-site scripting flaw in versions through 3.1.0. An attacker can plant script that runs in the browser of anyone who views the affected page.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["elementor","package","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated-past-3.1.0"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get powerpack-lite-for-elementor --field=version`\n- Confirm whether the plugin slug is `powerpack-lite-for-elementor`","fix":"- Update PowerPack Addons for Elementor (`powerpack-lite-for-elementor`) to a version later than `3.1.0`; the sources do not name the fixed version, so check the plugin's changelog\n- If no fixed version exists, remove the plugin or restrict who can edit content","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T03:57:55+00:00","updated_at":"2026-10-25T03:57:55+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:57:55Z","model":"claude-haiku-5-5","output":{"fix":"- Update PowerPack Addons for Elementor (`powerpack-lite-for-elementor`) to a version later than `3.1.0`; the sources do not name the fixed version, so check the plugin's changelog\n- If no fixed version exists, remove the plugin or restrict who can edit content","reach":"internet","title":"PowerPack Addons for Elementor: stored XSS through version 3.1.0","impact":"medium","summary":"PowerPack Addons for Elementor, a WordPress plugin, has a stored cross-site scripting flaw in versions through 3.1.0. An attacker can plant script that runs in the browser of anyone who views the affected page.","category":"package","nicknames":[],"who_cares":["wordpress","elementor","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' browsers, possibly stealing admin sessions","analyst_note":"Find the fixed version and the required privilege level in the NVD entry or the plugin's changelog.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get powerpack-lite-for-elementor --field=version`\n- Confirm whether the plugin slug is `powerpack-lite-for-elementor`","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-updated-past-3.1.0"],"who_is_affected":"Sites running PowerPack Addons for Elementor at version 3.1.0 or earlier are exposed. Exploitation needs a way to store input that is later rendered to visitors, so sites where only trusted editors can write content carry less risk. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000649,"input_tokens":3336,"output_tokens":630,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111400':12A,15A '-2026':11A,14A '3.1.0':9A,40B,95C 'addon':2A,23B,75C,89C 'affect':56B,87C 'allow':83C 'anyon':52B 'attack':42B 'browser':50B 'creation':73C 'cross':33B,67C 'cross-sit':32B,66C 'cve':10A,13A 'elementor':4A,16B,25B,77C,82C,91C 'flaw':36B 'generat':65C 'host':20B 'ideabox':72C 'improp':58C 'input':61C 'issu':86C 'lite':80C 'n/a':93C 'neutral':59C 'packag':17B 'page':57B,64C 'plant':44B 'plugin':28B 'powerpack':1A,22B,74C,79C,88C 'powerpack-lite-for-elementor':78C 'run':47B 'script':35B,45B,69C 'self':19B 'self-host':18B 'site':34B,68C 'store':5A,31B,84C 'version':8A,38B 'view':54B 'vulner':70C 'web':63C 'wordpress':21B,27B 'xss':6A 'xss.this':85C","nicknames":[],"mitigations":[],"who_affected":"Sites running PowerPack Addons for Elementor at version 3.1.0 or earlier are exposed. Exploitation needs a way to store input that is later rendered to visitors, so sites where only trusted editors can write content carry less risk. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111400","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111400","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}